The Biometric Information Privacy Act (BIPA) establishes safeguards and procedures relating to the retention, collection, disclosure, and destruction of biometric data. Passed in October 2008, BIPA is intended to protect a person’s unique biological traits – the data encompassed in a person’s fingerprint, voice print, retinal scan, or facial geometry. This information is the most sensitive data belonging to an individual. Unlike a PIN code or a social security number, once biometric data is compromised, “the individual has no recourse, is at [a] heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” 740 ILCS 14/5(c). For this reason, BIPA provides a private right of action for “[a]ny person aggrieved by a violation of this Act . . . .” 740 ILCS 14/20.
The question facing Illinois courts is what it means to be “aggrieved.” In McCollough v. Smarte Carte, Inc., the plaintiff alleged an injury under BIPA stemming from her use of a fingerprint-operated electronic locker. McCollough v. Smarte Carte, Inc., No. 16 C 03777, 2016 WL 4077108, at *1 (N.D. Ill. Aug. 1, 2016). Holding that McCollough “undoubtedly understood when she first used the system that her fingerprint data would have to be retained until she retrieved her belongings from the locker,” the court concluded that McCollough was not an “aggrieved” person within the meaning of the statute. Id. at *3.
McCollough was the first reported case to interpret the meaning of “aggrieved” and helped inform the Illinois Appellate Court, Second District, decision in Rosenbach v. Six Flags Entertainment Corporation. In Rosenbach, the Second District accepted a certified question to answer whether BIPA required “a person aggrieved by a violation of [the] Act” to allege an actual harm. Rosenbach v. Six Flags Entm't Corp., 2017 IL App (2d) 170317, ¶1. Reviewing McCollough, Black’s Law Dictionary, and other authorities, the Second District held that if “a person alleges only a technical violation of the Act without alleging any injury or adverse effect, then he or she is not aggrieved and may not recover under any of the provisions in section 20.” Id. at ¶28 (emphasis added). The Second District did note, however, that an “injury or adverse effect need not be pecuniary.”
Rosenbach is not without its critics, both within and outside of Illinois. In Facebook, the U.S. District Court for the Northern District of California found that Rosenbach was not a good predictor “of how the Illinois Supreme Court would interpret ‘aggrieved’ under BIPA.” See In re Facebook Biometric Info. Privacy Litig., No. 3:15-CV-03747-JD, 2018 WL 1794295, at *6-8 (N.D. Cal. Apr. 16, 2018), appeal filed by Patel v. Facebook, Inc., No. 18-15982 (9th Cir. May 30, 2018).
The Facebook Court’s decision may be prophetic. The Illinois Appellate Court, First District, recently held that a statutory violation – without more – was sufficient to confer standing under BIPA. Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175, at ¶77. Splitting with the Second District’s interpretation, the Sekura Court held that a plaintiff suing under BIPA did not need to allege any additional harm and to hold otherwise would render the word “‘aggrieved’ in the Act . . . superfluous.” Id. at ¶74. The Sekura Court went on to note that plaintiff’s allegations of mental anguish – wondering what might become of her biometric data if L.A. Tan Enterprises went bankrupt – would have satisfied the “injury or adverse effect” requirement of Rosenbach in any event. Id. at ¶78.
The Sekura and Rosenbach decisions represent two approaches to interpreting the meaning of “aggrieved” under BIPA. This split is likely to be resolved by the Illinois Supreme Court, which has allowed an appeal of the Rosenbach decision. 98 N.E.3d 36 (Ill. May 30, 2018). Briefing in the case is complete and oral argument is expected sometime in November 2018. In the meantime, defendants litigating BIPA cases in the First District should be cautious in their approach or otherwise risk getting burned.
(More information about BIPA and the cases interpreting the statute can be found here.)
PartnerCharles N. Insler is an accomplished writer who helps spearhead the firm’s appellate practice. He has briefed more than 15 appeals over the last five years, covering a variety of procedural and substantive legal issues. Mr ...
